4 ms·

schneier on open wifi networks (he's for them): http://www.schneier.com/blog/archives/2011/04/security_risks_7.html http://www.schneier.com/blog/archives/2011/0

by zem 14y ago

schneier on open wifi networks (he's for them): http://www.schneier.com/blog/archives/2011/04/security_risks_7.html http://www.schneier.com/blog/archives/2011/04/security_risks...

pdonis 14y ago
I normally agree with Schneier, but I think he's wrong on this one. Basically his argument is that, rather than try to secure your wifi, you should just leave it open and make sure your personal computers are secure enough to be used on an open network. He points out that, if you use your laptop on public networks, you have to secure it anyway, so there's no additional risk to having your home wifi basically be a public network. All that may be true (though I would argue that, since you use your home connection a lot more than any other, your risk exposure is much greater and therefore it makes sense to have a layered defense there), but it completely misses the point that you are responsible to your ISP for how your internet connection gets used. Starbuck's may be able to say "look, we're a public place, we can't possibly control everything that everybody does on our wifi", and get away with just making people check an "I agree to your terms of use" box when they connect to their wifi. You, as a home user, are not likely to get away with that. Schneier also says this: "if someone did commit a crime using my network the police might visit, but what better defense is there than the fact that I have an open wireless network? If I enabled wireless security on my network and someone hacked it, I would have a far harder time proving my innocence." This seems backwards to me: if you have enabled wireless security, you know exactly who you have authorized access to--it's whoever you gave your passphrase to. So it's easy to distinguish authorized from unauthorized use. If you leave your wifi open and someone uses it for something nefarious, how can you defend yourself? You're still liable for the use of your internet connection, and you can't say the use was unauthorized because, well, you left your wifi open for anyone to use.
- crististm 14y ago
  "You, as a home user, are not likely to get away with that." His point is that you _should_ be able to get away with that. Precisely because there is no difference between an open network and a cracked one!!!
  - pdonis 14y ago
    there is no difference between an open network and a cracked one!!! Yes, there is. An open network means whoever is providing the wifi disclaims all responsibility for how the network is used. Starbuck's may be able to get away with that, as I said, but I don't think the average home user can, unless they have a really unusual ISP. Have you read the fine print in your ISP's terms and conditions? If the point is that home users should not have to tolerate those kinds of terms and conditions, I don't disagree; but I don't expect it to happen any time soon. :-)
    - jessaustin 14y ago
      As Schneier describes it, there is a trade-off. Would you rather be kicked by your ISP for T&C violations, or imprisoned and branded a sex offender for your neighborhood wireless hacker's kiddie porn habits? If the chances of each scenario were roughly equal, I'd certainly agree with Schneier to prefer the former scenario. Since the former scenario seems much more likely than the latter I'm not so sure.
      - pdonis 14y ago
        your neighborhood wireless hacker's kiddie porn habits If your wifi is secured and there are open networks nearby, the hacker isn't going to bother trying to hack yours (I assume you're using WPA, not WEP, the latter is so easy to hack now that it doesn't really make a difference). He's going to use one of the open ones. To have a serious chance of having your WPA hacked you would need to have attracted the notice of someone much more determined than your neighborhood porn junkie, someone like the NSA. So I would say the former scenario is much more likely than the latter.
        crististm 14y ago
        Let's see: You are a high profile figure who happened to step on someone's tail. What should we do to make you behave? I know, we'll show the whole world how you download child porn. Did I say "child porn"? You mean the burden of proof is on you that you secured your network? How can you prove this, because, you know, you can't!

by zem 14y ago

schneier on open wifi networks (he's for them): http://www.schneier.com/blog/archives/2011/04/security_risks_7.html http://www.schneier.com/blog/archives/2011/04/security_risks...

pdonis 14y ago

I normally agree with Schneier, but I think he's wrong on this one. Basically his argument is that, rather than try to secure your wifi, you should just leave it open and make sure your personal computers are secure enough to be used on an open network. He points out that, if you use your laptop on public networks, you have to secure it anyway, so there's no additional risk to having your home wifi basically be a public network. All that may be true (though I would argue that, since you use your home connection a lot more than any other, your risk exposure is much greater and therefore it makes sense to have a layered defense there), but it completely misses the point that you are responsible to your ISP for how your internet connection gets used. Starbuck's may be able to say "look, we're a public place, we can't possibly control everything that everybody does on our wifi", and get away with just making people check an "I agree to your terms of use" box when they connect to their wifi. You, as a home user, are not likely to get away with that. Schneier also says this: "if someone did commit a crime using my network the police might visit, but what better defense is there than the fact that I have an open wireless network? If I enabled wireless security on my network and someone hacked it, I would have a far harder time proving my innocence." This seems backwards to me: if you have enabled wireless security, you know exactly who you have authorized access to--it's whoever you gave your passphrase to. So it's easy to distinguish authorized from unauthorized use. If you leave your wifi open and someone uses it for something nefarious, how can you defend yourself? You're still liable for the use of your internet connection, and you can't say the use was unauthorized because, well, you left your wifi open for anyone to use.

crististm 14y ago
"You, as a home user, are not likely to get away with that." His point is that you _should_ be able to get away with that. Precisely because there is no difference between an open network and a cracked one!!!
- pdonis 14y ago
  there is no difference between an open network and a cracked one!!! Yes, there is. An open network means whoever is providing the wifi disclaims all responsibility for how the network is used. Starbuck's may be able to get away with that, as I said, but I don't think the average home user can, unless they have a really unusual ISP. Have you read the fine print in your ISP's terms and conditions? If the point is that home users should not have to tolerate those kinds of terms and conditions, I don't disagree; but I don't expect it to happen any time soon. :-)
  - jessaustin 14y ago
    As Schneier describes it, there is a trade-off. Would you rather be kicked by your ISP for T&C violations, or imprisoned and branded a sex offender for your neighborhood wireless hacker's kiddie porn habits? If the chances of each scenario were roughly equal, I'd certainly agree with Schneier to prefer the former scenario. Since the former scenario seems much more likely than the latter I'm not so sure.
    - pdonis 14y ago
      your neighborhood wireless hacker's kiddie porn habits If your wifi is secured and there are open networks nearby, the hacker isn't going to bother trying to hack yours (I assume you're using WPA, not WEP, the latter is so easy to hack now that it doesn't really make a difference). He's going to use one of the open ones. To have a serious chance of having your WPA hacked you would need to have attracted the notice of someone much more determined than your neighborhood porn junkie, someone like the NSA. So I would say the former scenario is much more likely than the latter.
      - crististm 14y ago
        Let's see: You are a high profile figure who happened to step on someone's tail. What should we do to make you behave? I know, we'll show the whole world how you download child porn. Did I say "child porn"? You mean the burden of proof is on you that you secured your network? How can you prove this, because, you know, you can't!